The automatic reboot sequence makes sure that the
file systems available on the system are consistent. If they
are not, and fsck(8) cannot fix the
inconsistencies, init(8) drops the system
into single-user mode
for the system administrator to take care of the problems
directly.

If the system console is set
to insecure in /etc/ttys,
then the system prompts for the root password
before initiating single-user mode.

Example 7-3. An Insecure Console in /etc/ttys

# name getty type status comments
#
# If console is marked "insecure", then init will ask for the root password
# when going to single-user mode.
console none unknown off insecure

Note: An insecure console means that you
consider your physical security to the console to be
insecure, and want to make sure only someone who knows the
root password may use single-user mode, and it
does not mean that you want to run your console insecurely. Thus,
if you want security, choose insecure,
not secure.

The resource configuration system reads in
configuration defaults from
/etc/defaults/rc.conf, and
system-specific details from
/etc/rc.conf, and then proceeds to
mount the system file systems mentioned in
/etc/fstab, start up networking
services, start up miscellaneous system daemons, and
finally runs the startup scripts of locally installed
packages.

The rc(8) manual page is a good reference to the resource
configuration system, as is examining the scripts
themselves.